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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 


review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


The Young Scot 5Rights Youth Leadership Group is pleased to see 
that children and young people will be better defined and 
designed for with regards to their age and development needs in 
the Age Appropriate Design Code. The Youth Leaders would 
however like to highlight that, despite being at the same age, no 
two young people are the same and their development needs or 
experiences could still differ greatly. The Youth Leadership Group 
encourages flexibility in the Code to allow case by case 
considerations of the individual young person, as grouping young 
people solely by age can risk overlooking the diversity of other 
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factors that can have an impact on a young person’s maturity and 
ability to handle different situations. Alternatively, young people 
could be grouped by the actual developmental milestones reached 


instead of age. 


Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 


brackets. 


Aged 3-4: pre-school/nursery 
years 


Aged 5-7: start of primary 


Aged 8-10: later primary 
school years 


3 
4 
5 
|6 | school 
7 
8 
9 


Aged 3-8: young people in 
this age range might have 
significant needs for 
support and guidance from 
adults 


11 | Aged 11-12: start of secondary 
12 | school - transitional years for 
young people 


Aged 9-12: young people 
might feel left out, being 
in an ‘in-between’ age - no 
longer a young child but 
not yet into adolescence. 
Young people in this age 
range might want to be 
treated as grown-ups, but 
physically not yet at that 
stage 


15 | parents or carer 


13 | Aged 13-15: the start of teenage years. Young people in this 
14 | age range might be given increasing independence by their 


Scotland). 


16 | Aged 16-17: senior years of school. Young people’s focus are 
17 | likely to be on their future plans, employability and own 
persona - their place in society and how others might 
perceive them. Young people in this age range are also given 
more rights as citizens - for example, the right to vote (in 


The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 


when drafting the Code. 
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Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


To apply the UNCRC in the context of setting the design standards, 
the Youth Leaders suggest the considerations of the 5Rights 
Framework and all of its principles. The Youth Leaders have also 
highlighted the following articles from the UNCRC, and how they 
might apply: 


Article 3 (best interests of children). All decisions made in 
the design of products and services, should be made in the 
best interest of children of each age groups or development 
needs 

Article 5 (parental guidance and a child’s evolving 
capacities). More options should be given to older young 
people (for example, aged 16-17) to control and make 
decisions about their own data, so as to recognise and 
respect a young person’s evolving capacities 

Article 12 (respect for the views of the child). Young people 
should be meaningfully involved in setting standards and 
policies in the digital world, and be given the platform to 
influence such policies. This goes beyond young people’s 
freedom to express - their opinions must be respected and 
actively consulted by those who design digital services, and 
by those who regulate them. 

Article 16 (right to privacy) and Article 8 (protection and 
preservation of identity). Respecting the privacy of a young 
person and protecting their identity must be the core 
principle of the design standards. There should be specific 
guidelines regarding the use of trackers or cookies with 
young users. Through the Code, young people should also be 
given choices on how much data they want to share, and no 
data has to be given in order for young people to gain access 
to services 

Article 17 (access to information from the media). Sensitive 
materials should be hidden automatically for younger 
children. Older young people should be given a choice to opt 
in or out of what they can see, and warnings about sensitive 
materials should always be given. Terms and conditions and 
privacy policy documents should be written and presented in 
such ways that the user can easily access and understand. 
Young people should also be given the confidence that the 
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information they consume from a service is reliable and 
valid. The Youth Leaders feel that ISS providers should be 
held accountable if they are found to be allowing 
misinformation to spread on their platform. 

e Article 27 (adequate standard of living). Providing excellent 
standards that meet the physical and mental needs of young 
people should be the overall aim of the Code, and by 
extension that of the design of digital services. While the 
current state and provisions of many digital services can 
come under scrutiny in how lacking they might be in terms of 
supporting young people’s rights, the Code should also 
embrace the positive role of technology in meeting certain 
needs of young people, and aim to maximise access to such 
opportunities 

e Article 31 (leisure, play and culture). The design standards 
should recognise the importance of play for young people 
even in the digital context. Online activities for young people 
don’t always need to be educational, and learning outcomes 
don’t always come solely from educational sources. The 
internet provides ample and diverse opportunities for young 
people to develop wide ranging skills including social skills, 
and this should be encouraged 

e Article 42 (knowledge of rights). The Code should include 
standards for how a provider of ISS inform and educate their 
consumers about their rights, in a comprehensive way that is 
relevant to the user’s abilities and maturity. This has to be a 
continual process under the responsibility of the ISS 
provider, so that young people are aware of how and if their 
rights are supported 


Other issues that can interfere with young people’s rights in the 
digital world via a third party user should also be taken into 
considerations by the Code. For example, the issues around 
‘sharenting’, where parents might share pictures or information of 
their children without their explicit consent, or where a young 
person’s data has been shared by a third person, or tagged into a 
post that contain or allude to information about the young person 
that might or might not necessarily be true. 


Aspects of design 
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The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 


default privacy settings, 

data minimisation standards, 

the presentation and language of terms and conditions and privacy 
notices, 

uses of geolocation technology, 

automated and semi-automated profiling, 

transparency of paid-for activity such as product placement and 
marketing, 

the sharing and resale of data, 

the strategies used to encourage extended user engagement, 
user reporting and resolution processes and systems, 

the ability to understand and activate a child’s right to erasure, 
rectification and restriction, 

the ability to access advice from independent, specialist advocates 
on all data rights, and 

any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
should take into account when explaining the meaning and coverage of 
these terms in the code. 


e Default privacy settings: 


o Default privacy settings should encompass everything that 
is happening, or might happen, to a young person’s data. 
In considering these settings, the Code should consider 
the motivation behind the chosen default - whether they 
have been chosen by the provider to benefit themselves, 
or the user. They cover all settings that come pre-set or 
automatic with a service or product. 


e Data minimisation standards: 


o Data minimisations standards should mean that providers 
will always aim to ask for, and hold on to, as little data 
about the consumer as possible. Only a minimal amount of 
data should be obtained in order for the basic features of 
the service to function. 


e The presentation and language of terms and conditions and 
privacy notices: 
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o The presentation and language of terms and conditions 
should cover the choice of words, phrasing, length, 
format, and how the information is communicated to 
consumer, whether written or through interactions. At the 
minimum, terms and conditions should follow the same 
guidelines as those given around dyslexia - for instance, 
the colour of the text versus the colour of the background, 
the size of the font, the shape of font used, line spacing, 
the use of lower case instead of upper case, etc. The Code 
should also include standards on the meaningful choices 
that young people are given to opt-in or opt-out of sharing 
their data. 


e Sharing and resale of data: 

o This aspect should cover the potential involvement of any 
third party, and make their information transparent to 
young people. The Code should include standards that 
cover how young people can track where their data has 
been shared or sold to. The Youth Leaders also 
understand the concept that data is money to the 
industry, and feel that it should also be made clear and 
transparent to young people the value of their data. 


e Uses of geolocation technology: 

o Geolocation technology covers all location services, 
including online maps, and any information that 
accompanies their location, such as time, duration, and 
traffic information. It also covers any other details that 
might allude to the young person’s exact location. The 
Youth Leaders feel that such technology should be opted 
out by default, and that under no circumstances should 
the location information of a young person be saved and 
recorded. 


e Automated & semi-automated profiling: 

o The Youth Leaders feel that automated and semi- 
automated profiling often make wrong assumptions about 
people, and feel uncomfortable in the way they put people 
in ‘boxes’. Such feelings from young people should be 
taken into considerations by the Code, as well as the 
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methods by which data is scraped in the first place, such 
as the use of cookies. 


Strategies used to encourage extended user engagement: 


(@) 


This aspect covers the persuasive design of technology, 
and how transparent the purpose of these strategies are 
to young people. 


Transparency of paid-for activity: 


O 


The Youth Leaders feel that the code should include 
specific standards around advertisement and sponsorship, 
and how clearly these are labelled as such to young 
people. It should also cover the purchases in apps, and 
how any additional costs are presented or communicated 
to young people. 


User reporting and resolution processes and systems: 


O 


This aspect relates to young people’s right to safety and 
support, and the Code should cover the quality of support 
that is offered to young people by ISS providers, and how 
it corresponds to young people’s specific needs and 
wishes. The Youth Leaders, for example, feel that young 
people prefer human support to automated responses, 
and that this aspect should also cover how much control 
young people should have in protecting themselves - for 
example, the inability to un-tag oneself on Instagram. 


The ability to access advice from independent, specialist 
advocates on all data rights: 


oO 


With relevance to young people’s right to safety and 
support, this aspect should cover not only the ease of 
access to advice and support, but also the quality and 
reliability of the source of such support. The Youth 
Leaders feel that ISS providers should enable easy access 
for young people to independent advisors. The Code 
should therefore also cover how transparent the nature of 
any affiliation or relationship between the ISS provider 
and the independent body they link to. 


The ability to understand and activate a child’s right to erasure, 
rectification and restriction: 
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o The Code should cover how clear and transparent the ISS 
provider is about young people’s right to remove, rectify, 
and to restrict -— as per the GDPR and the 5Rights 
Framework. This should include the way in which the 
provider communicates such information to a young 
person - its presentation, its format, and how it 
corresponds to the young person’s specific level of 
abilities and understanding. 


Q5. Please provide any views or evidence you have on the following: 


Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


The Youth Leaders feel that the Code will be able to help raise 
awareness about young people’s rights and how they should be 
supported in the digital environment. This will include young 
people’s understanding of their own rights, and can empower 
young people in advocating for themselves. The Code will also 
give all users a greater confidence in the services provided to 
them, and how their needs and rights would have been taken into 
account by design. We anticipate the Code to change our society 
by bringing offline social norms and responsibilities into the 
online, and create a cultural shift from an accepted sense of 
unconsciousness and powerlessness in terms of usage and control 
of technology, to informed, conscious use and real power in young 
people’s hands to manage their own digital self. 


The challenges that the Youth Leaders see for the Code, are 
largely to do with how the Code will be inclusive to all young 
people and their diversities, and how it can cater for all the 
different needs within each age category. The Youth Leaders also 
see challenges in how the industry might interpret the standards. 
The meaning of the Code must be explicit, so that lines cannot be 
blurred. With the accelerating pace of technology, it is also vital 
that the Code is future-proof. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 
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In ensuring the rights of young people are fully realised in the 
digital world and by all ISS, the ICO should work closely with the 
Children and Young People’s Commissioners across the UK. The 
Youth Leaders also feel that the most important and relevant 
stakeholder that the ICO can work with in designing the Code, is 
children and young people themselves, and would encourage the 
Code to be co-designed with young people - involving meaningful 
involvement of young people in all decision-making processes, 
from as early on as possible in the process. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


Data privacy: 
e Aged 3- 12: options to track or collect data should be opted out by default, without 
options to give consent to collect data 
e Aged 13-15: options should still be opted out by default, but with some options to give 
and customise consent to collect data 
e Aged 16-17: options should still be opted out by default, with all options available to give 
and customise consent to collect data 


Data minimisation standards: 
e Aged 3-12: no data should be collected or stored 


e Aged 13-17: data should only be stored with explicit consent 


Presentation and language of terms and conditions: 

e Aged 3-12: Terms and conditions consented by a parent/carer on behalf of child. Terms 
contained within should be strict and provide maximum protection to the child, and 
should be specific to this age group who might not have the capacity to give informed 
consent. Language used should still be simple and accessible even though it will be read 
primarily by parent/carer acting on behalf of their child 

e Aged 13-17: Language and presentation of terms and conditions should be accessible and 
appropriate to the reading age of this group. The Youth Leaders recommend the 5Rights 
Youth Commission’s recommendation (3.1)* in considering its presentation 


Use of geolocation technology 
e Aged 3-9: There should not be any collection of or access to young people’s geolocation 
data in this age group 
e Aged 10-17: The use of geolocation technology should be opted-out by default, but young 
people in this age group can be given choices to activate its use. However, while access to 


1 Recommendation 3.1, p.30, ‘Our Digital Rights’, Young Scot 5Rigths Youth Commission 
May 2017. 
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geolocation data can be consented by the young person in this age group, no such data 
about a young person should be recorded or stored under any circumstances 


Automated and semi-automated profiling 


Aged 3- 12: No access should be allowed from services to perform automated or semi- 
automated profiling on young people in this age group 

Aged 13-17: Automated or semi-automated profiling can only be performed on young 
people in this age group with their explicit and informed consent 


Transparency of paid-for activity 


All paid for activities should be clearly labelled as such, and made transparent to both the 
young person using the service and their parent/carer 


Sharing and resale of data 


Aged 3-15: No sharing or resale of data should be allowed for young people in this age 
group 

Aged 16-17: Sharing and resale of data should be opted-out by default, with options for 
young people to express explicit and informed consent to sharing only if it will benefit the 
young person’s experience with the service 


Strategies used to encourage extended user engagement 


Aged 3-15: No such strategies should be used in this age group 
Aged 16-17: Services should be transparent in their use and intention of such strategies, 
and provide accessible ways for young people to opt-up of these strategies 


User reporting and resolution process and systems 


Aged 3-9: ISS should make it accessible not only for young people to reporting and support 
processes, but also for the parent, carer, or adult acting on behalf of the young person in 
this age group 

Aged 10-17: Processes should be made accessible and easy to follow for young people, 
with support given by human rather than algorithms or automated responses 


Ability to understand and activate a child’s right to erasure, 
rectification and restriction 


Clear information about a young person’s right to erasure, rectification and restriction, as 
well as guidance on how to activate this right, should be provided by the ISS to young 
people in an age appropriate and accessible way. 


The ability to understand and access advice from independent, 
specialist advocates on all data rights: 


Aged 3-15: ISS should facilitate access to age appropriate advice, that increases in 
complexity in accordance to the young person’s age, abilities and needs 

Aged 16-17: detailed advice should be made available and accessible to young people in 
this age group at any given time. 


Q5D. examples of ISS design you consider to be good practice. 
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The ‘What’s Your Story’ website by the Scottish Book Trust? 
provides a great example of a privacy policy? that is age 
appropriate and easily understandable to young people. The 
website also clearly explains the rights that young people have’, 
how their service supports these rights, and how young people 
can activate and exercise their rights. 


Q5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 

The Youth Leaders would like to stress the importance of genuine 
co-production with young people, both in the creation of the Code 
and in the design of digital services. They would like to encourage 
this approach by policymakers and industry alike. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


Name Young Scot 5Rights Youth Leadership Group (and Young 
Scot) 


Email 5Rights@young.scot 


Brief summary of what you think you could offer 

Young Scot is the national youth information and citizenship 
charity for Scotland. We work with young people aged 11-26, and 
provide them with information, ideas and access to opportunities. 
Through our co-design services, we give young people the power 
to create real change to policy, practice and services, by involving 
them systematically in decision making processes in collaboration 
with organisations. Since April 2015, Young Scot has been the 
lead strategic partner for 5Rights in Scotland, and has been 
raising awareness of young people’s rights in the digital world in 
Scotland. At the core of our work around 5Rights, is supporting 
young people to lead on this process, and empowering them to be 
champions of their own rights. This is done through the Young 
Scot 5Rights Youth Commission and the Young Scot 5Rights Youth 


* What’s Your Story <https://www.thestoryis.co.uk/> 
3 What’s Your Story - Privacy Policy <https://www.thestoryis.co.uk/privacy-policy/> 
4 What’s Your Story —- Your Rights <https://www.thestoryis.co.uk/your-rights/> 
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Leadership Group, both of which have been launched in 
partnership with the Scottish Government and the 5Rights 
Foundation. The Youth Commission was commissioned in February 
2016 to co-design the recommendations for how young people’s 
rights can be realised in the digital world - a 15-month 
investigation that culminated in twenty recommendations in their 
report, ‘Our Digital Rights” in May 2017. The Young Scot 5Rights 
Youth Leadership Group, launched in February 2018, are now 
currently investigating how some of these recommendations can 
be implemented in Scotland. The success of both of these projects 
have shown that young people are experts of their own 
experiences, and that their voices and lived experiences are vital 
and powerful in creating a digital world that empowers and 
respects young people. With the experiences of the young people 
from the Youth Leadership Group, as well as Young Scot’s 
expertise in co-designing with young people, we will be able to 
connect the Commissioner with the young people of Scotland via 
the Youth Leadership Group, and support the Commissioner in co- 
creating with young people an Age Appropriate Design Code that 
befits the needs, priorities, and hopes of young people for their 
digital world. 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 


° Young Scot 5Rights Youth Commission, ‘Our Bigitat Rights’, May 2017. 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 

Young Scot is the national youth information and 
citizenship charity in Scotland. The response given 
in this document was prepared by the Young Scot 
5Rights Youth Leadership Group. Launched in 
February 2018 by Young Scot, the Scottish 
Government, and 5Rights, the Young Scot 5Rights 
Youth Leadership Group is a diverse group of 30 
young people from across Scotland, aged 11 to 19, 
who champion their rights in the digital world. 
Their work builds on the recommendations co- 
designed by the Young Scot 5Rights Youth 
Commission in their report, ‘Our Btgitat Rights’, 
from May 2017, and focuses on investigating how 
these recommendations can be implemented and 
how young people’s rights can be realised in the 
digital world in practice. Specifically, the Youth 
Leaders are currently exploring how young people 
can support each other around their digital rights, 
the role that businesses can play in realising young 
people’s rights, what cyber resilience means to 
young people, and how innovative technology can 
help young people exercise their rights in the 
digital world. As part of 2018 the Year of Young 
People in Scotland, the Youth Leaders will also be 
hosting a 5Rights Summit for young people to 
celebrate and raise awareness of their 5Rights. 


A body representing the views or interests of parents? 
Please specify: 


A child development expert? 
Please specify: 
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A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 
Please specify: 


Thank you for responding to this call for evidence. 
We value your input. 
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